TUNSETLINK can change a TAP device's address length while packet memberships are active. The address lists are keyed by the current address length, so changing it makes subsequent membership cleanup lookups fail and strands netdev_hw_addr entries until unregister. Reject link-type changes that alter addr_len while either the unicast or multicast address list is non-empty. This prevents address entries from becoming unreachable through the normal deletion path. Fixes: cca8ea3b05c9 ("net: tun: set tun->dev->addr_len during TUNSETLINK processing") Cc: stable@vger.kernel.org Reported-by: Vega Signed-off-by: Zhiling Zou --- drivers/net/tun.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/tun.c b/drivers/net/tun.c index 5a302709a68aa..e5b7729a967de 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -3341,6 +3341,10 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd, netif_info(tun, drv, tun->dev, "Linktype set failed because interface is up\n"); ret = -EBUSY; + } else if (tun_get_addr_len(arg) != tun->dev->addr_len && + (!netdev_uc_empty(tun->dev) || + !netdev_mc_empty(tun->dev))) { + ret = -EBUSY; } else { ret = call_netdevice_notifiers(NETDEV_PRE_TYPE_CHANGE, tun->dev); -- 2.43.0